SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  User Administrator

  Why it's wrong here

  The User Administrator role provides extensive control over user accounts within Microsoft Entra ID, allowing the assigned technician to create new users, delete existing users, and manage all properties associated with user objects. While it certainly encompasses the ability to reset passwords, this role grants significantly more permissions than required for the stated task, including the dangerous capability to delete user accounts. Assigning this role would violate the principle of least privilege, as it provides unnecessary and potentially harmful administrative power.

  When this WOULD be correct

  A question where the technician needs to manage all user and group objects, including creating users, resetting passwords, and managing group memberships, but not have full administrative access.

• ✓

  Password Administrator

  Why this is correct

  The Password Administrator role in Microsoft Entra ID is specifically designed for helpdesk personnel who need to reset passwords for users and manage service requests related to identity issues. This role grants the necessary permissions to perform password resets without conferring broader administrative rights, such as the ability to create or delete user accounts, modify group memberships, or manage other user properties. It perfectly adheres to the principle of least privilege by providing only the capabilities essential for password management tasks.

• ✗

  Helpdesk Administrator

  Why it's wrong here

  Helpdesk Administrators can reset passwords and manage support tickets, but they also have permissions to modify user properties such as email address and job title, which might be more than required, and they can also delete users in some scenarios.

  When this WOULD be correct

  A company needs a technician who can reset passwords AND manage service requests (support tickets) in the Microsoft 365 admin center, but not delete users or modify groups. In that scenario, Helpdesk Administrator would be the correct role.

• ✗

  Global Administrator

  Why it's wrong here

  The Global Administrator role is the most privileged role in Microsoft Entra ID, granting unfettered access to all administrative features across all Microsoft cloud services, including the ability to manage all users, groups, applications, and even other administrative roles. Assigning this role to an IT support technician whose primary responsibility is password resets would be a severe security misconfiguration. This role provides far more power than necessary, posing a significant risk of accidental or malicious misuse, and fundamentally contradicts the principle of least privilege.

  When this WOULD be correct

  This role would be correct if the question asked for a role that can manage all aspects of Microsoft Entra ID, including security settings, user administration, and access to all administrative features, with no restrictions.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question